diff --git a/src/device_registration_info.cc b/src/device_registration_info.cc
index 68c5505..f437b34 100644
--- a/src/device_registration_info.cc
+++ b/src/device_registration_info.cc
@@ -936,7 +936,7 @@
   auth_info_update_inprogress_ = true;
 
   std::string id = GetSettings().device_id;
-  std::string token = Base64Encode(auth_manager_->GetRootClientAuthToken());
+  std::string token = Base64Encode(auth_manager_->ClaimRootClientAuthToken());
   std::string fingerprint =
       Base64Encode(auth_manager_->GetCertificateFingerprint());
 
diff --git a/src/device_registration_info_unittest.cc b/src/device_registration_info_unittest.cc
index cc519d2..66a9b1d 100644
--- a/src/device_registration_info_unittest.cc
+++ b/src/device_registration_info_unittest.cc
@@ -70,7 +70,6 @@
 const char kAuthInfo[] = R"({
   "certFingerprint":
   "FQY6BEINDjw3FgsmYChRWgMzMhc4TC8uG0UUUFhdDz0=",
-  "clientToken": "UBPkqttkiWt5VWgICLP0eHuCQgECRgMaVm0+gA==",
   "localId": "f6885e46-b432-42d7-86a5-d759bfb61f62"
 })";
 
@@ -269,7 +268,10 @@
       .WillOnce(WithArgs<3, 4>(
           Invoke([](const std::string& data,
                     const HttpClient::SendRequestCallback& callback) {
-            EXPECT_JSON_EQ(test_data::kAuthInfo, *CreateDictionaryValue(data));
+            auto dict = CreateDictionaryValue(data);
+            EXPECT_TRUE(dict->HasKey("clientToken"));
+            dict->Remove("clientToken", nullptr);
+            EXPECT_JSON_EQ(test_data::kAuthInfo, *dict);
             base::DictionaryValue json;
             callback.Run(ReplyWithJson(200, json), nullptr);
           })));
@@ -561,7 +563,10 @@
       .WillOnce(WithArgs<3, 4>(
           Invoke([](const std::string& data,
                     const HttpClient::SendRequestCallback& callback) {
-            EXPECT_JSON_EQ(test_data::kAuthInfo, *CreateDictionaryValue(data));
+            auto dict = CreateDictionaryValue(data);
+            EXPECT_TRUE(dict->HasKey("clientToken"));
+            dict->Remove("clientToken", nullptr);
+            EXPECT_JSON_EQ(test_data::kAuthInfo, *dict);
             base::DictionaryValue json;
             callback.Run(ReplyWithJson(200, json), nullptr);
           })));
diff --git a/src/privet/auth_manager.cc b/src/privet/auth_manager.cc
index 1862d62..92c33a7 100644
--- a/src/privet/auth_manager.cc
+++ b/src/privet/auth_manager.cc
@@ -112,14 +112,13 @@
 
 std::vector<uint8_t> AuthManager::ClaimRootClientAuthToken() {
   pending_claims_.push_back(
-      std::unique_ptr<AuthManager>{new AuthManager{{}, {}}});
+      std::unique_ptr<AuthManager>{new AuthManager{{}, {}, clock_}});
   if (pending_claims_.size() > kMaxPendingClaims)
     pending_claims_.pop_front();
   return pending_claims_.back()->GetRootClientAuthToken();
 }
 
-bool AuthManager::ConfirmRootClientAuthToken(
-    const std::vector<uint8_t>& token) {
+bool AuthManager::ConfirmAuthToken(const std::vector<uint8_t>& token) {
   // Cover case when caller sent confirm twice.
   if (pending_claims_.empty() && IsValidAuthToken(token))
     return true;
diff --git a/src/privet/auth_manager.h b/src/privet/auth_manager.h
index f1b6c8b..8fcadfc 100644
--- a/src/privet/auth_manager.h
+++ b/src/privet/auth_manager.h
@@ -36,12 +36,11 @@
 
   base::Time Now() const;
 
-  std::vector<uint8_t> GetRootClientAuthToken() const;
-
-  bool IsValidAuthToken(const std::vector<uint8_t>& token) const;
-
   std::vector<uint8_t> ClaimRootClientAuthToken();
-  bool ConfirmRootClientAuthToken(const std::vector<uint8_t>& token);
+  bool ConfirmAuthToken(const std::vector<uint8_t>& token);
+
+  std::vector<uint8_t> GetRootClientAuthToken() const;
+  bool IsValidAuthToken(const std::vector<uint8_t>& token) const;
 
  private:
   base::DefaultClock default_clock_;
diff --git a/src/privet/auth_manager_unittest.cc b/src/privet/auth_manager_unittest.cc
index ee50e08..4bef217 100644
--- a/src/privet/auth_manager_unittest.cc
+++ b/src/privet/auth_manager_unittest.cc
@@ -150,28 +150,28 @@
   auto token = auth_.ClaimRootClientAuthToken();
   EXPECT_FALSE(auth_.IsValidAuthToken(token));
 
-  EXPECT_TRUE(auth_.ConfirmRootClientAuthToken(token));
+  EXPECT_TRUE(auth_.ConfirmAuthToken(token));
   EXPECT_TRUE(auth_.IsValidAuthToken(token));
 }
 
 TEST_F(AuthManagerTest, ClaimRootClientAuthTokenDoubleConfirm) {
   auto token = auth_.ClaimRootClientAuthToken();
-  EXPECT_TRUE(auth_.ConfirmRootClientAuthToken(token));
-  EXPECT_TRUE(auth_.ConfirmRootClientAuthToken(token));
+  EXPECT_TRUE(auth_.ConfirmAuthToken(token));
+  EXPECT_TRUE(auth_.ConfirmAuthToken(token));
 }
 
 TEST_F(AuthManagerTest, DoubleClaimRootClientAuthToken) {
   auto token1 = auth_.ClaimRootClientAuthToken();
   auto token2 = auth_.ClaimRootClientAuthToken();
-  EXPECT_TRUE(auth_.ConfirmRootClientAuthToken(token1));
-  EXPECT_FALSE(auth_.ConfirmRootClientAuthToken(token2));
+  EXPECT_TRUE(auth_.ConfirmAuthToken(token1));
+  EXPECT_FALSE(auth_.ConfirmAuthToken(token2));
 }
 
 TEST_F(AuthManagerTest, ClaimRootClientAuthTokenOverflow) {
   auto token = auth_.ClaimRootClientAuthToken();
   for (size_t i = 0; i < 100; ++i)
     auth_.ClaimRootClientAuthToken();
-  EXPECT_FALSE(auth_.ConfirmRootClientAuthToken(token));
+  EXPECT_FALSE(auth_.ConfirmAuthToken(token));
 }
 
 }  // namespace privet
diff --git a/src/privet/mock_delegates.h b/src/privet/mock_delegates.h
index b661809..2065e9b 100644
--- a/src/privet/mock_delegates.h
+++ b/src/privet/mock_delegates.h
@@ -64,6 +64,8 @@
                      UserInfo(const std::string&, base::Time*));
   MOCK_CONST_METHOD0(GetPairingTypes, std::set<PairingType>());
   MOCK_CONST_METHOD0(GetCryptoTypes, std::set<CryptoType>());
+  MOCK_METHOD0(ClaimRootClientAuthToken, std::string());
+  MOCK_METHOD1(ConfirmAuthToken, bool(const std::string& token));
   MOCK_CONST_METHOD1(IsValidPairingCode, bool(const std::string&));
   MOCK_METHOD5(
       StartPairing,
@@ -80,6 +82,9 @@
     EXPECT_CALL(*this, CreateAccessToken(_))
         .WillRepeatedly(Return("GuestAccessToken"));
 
+    EXPECT_CALL(*this, ClaimRootClientAuthToken())
+        .WillRepeatedly(Return("RootClientAuthToken"));
+
     EXPECT_CALL(*this, ParseAccessToken(_, _))
         .WillRepeatedly(DoAll(SetArgPointee<1>(base::Time::Now()),
                               Return(UserInfo{AuthScope::kViewer, 1234567})));
diff --git a/src/privet/privet_handler.cc b/src/privet/privet_handler.cc
index ab4eece..94061a5 100644
--- a/src/privet/privet_handler.cc
+++ b/src/privet/privet_handler.cc
@@ -685,6 +685,7 @@
   output.SetString(kAuthTokenTypeKey, kAuthorizationHeaderPrefix);
   output.SetInteger(kAuthExpiresInKey, kAccessTokenExpirationSeconds);
   output.SetString(kAuthScopeKey, EnumToString(requested_auth_scope));
+
   callback.Run(http::kOk, output);
 }
 
diff --git a/src/privet/security_delegate.h b/src/privet/security_delegate.h
index 051bf20..3446c48 100644
--- a/src/privet/security_delegate.h
+++ b/src/privet/security_delegate.h
@@ -34,6 +34,13 @@
   // Returns list of crypto methods supported by devices.
   virtual std::set<CryptoType> GetCryptoTypes() const = 0;
 
+  // Returns Root Client Authorization Token.
+  virtual std::string ClaimRootClientAuthToken() = 0;
+
+  // Confirms pending pending token claim or checks that token is valid for the
+  // active secret.
+  virtual bool ConfirmAuthToken(const std::string& token) = 0;
+
   // Returns true if |auth_code| provided by client is valid. Client should
   // obtain |auth_code| during pairing process.
   virtual bool IsValidPairingCode(const std::string& auth_code) const = 0;
diff --git a/src/privet/security_manager.cc b/src/privet/security_manager.cc
index 5018d5a..34c65f0 100644
--- a/src/privet/security_manager.cc
+++ b/src/privet/security_manager.cc
@@ -135,6 +135,17 @@
   return result;
 }
 
+std::string SecurityManager::ClaimRootClientAuthToken() {
+  return Base64Encode(auth_manager_->ClaimRootClientAuthToken());
+}
+
+bool SecurityManager::ConfirmAuthToken(const std::string& token) {
+  std::vector<uint8_t> token_decoded;
+  if (!Base64Decode(token, &token_decoded))
+    return false;
+  return auth_manager_->ConfirmAuthToken(token_decoded);
+}
+
 bool SecurityManager::IsValidPairingCode(const std::string& auth_code) const {
   if (is_security_disabled_)
     return true;
diff --git a/src/privet/security_manager.h b/src/privet/security_manager.h
index 7a3c56a..5d9b75a 100644
--- a/src/privet/security_manager.h
+++ b/src/privet/security_manager.h
@@ -65,6 +65,8 @@
                             base::Time* time) const override;
   std::set<PairingType> GetPairingTypes() const override;
   std::set<CryptoType> GetCryptoTypes() const override;
+  std::string ClaimRootClientAuthToken() override;
+  bool ConfirmAuthToken(const std::string& token) override;
   bool IsValidPairingCode(const std::string& auth_code) const override;
 
   bool StartPairing(PairingType mode,